FCP_FGT_AD-7.6 Practice Questions Preview

Question 1

Single choice

A FortiGate administrator wants to enforce a DNS filter profile, but the DNS filter does not trigger even when domains match the block list.

What must be checked?

A
Whether DNS traffic is intercepted via explicit proxy
B
Whether DNS traffic is matching the correct firewall policy
C
Whether DNS filtering is enabled under system features
D
Whether FortiGate is configured as a DNS forwarder

Reveal answer details Close answer details

Correct answerB

Explanation

DNS filters apply only on firewall policies that process DNS traffic. If the DNS traffic does not match a policy that includes a DNS filter profile, blocking actions will not occur.

Question 2

Single choice

Refer to the exhibits.

ht

You are asked to implement an antivirus profile for files downloaded through FTP, HTTP, and HTTPS.

While testing, you are successful with HTTP and FTP protocols, but FortiGate does not block the file download over HTTPS.

What could be the cause?

A
The feature set in the antivirus profile is not set to Flow-based.
B
Web filter is not enabled on the firewall policy to complement the antivirus profile.
C
The action on the firewall policy is not set to deny.
D
The SSL inspection mode in the firewall policy is not deep content inspection.

Reveal answer details Close answer details

Correct answerD

Question 3

Single choice

You have configured the below commands on a FortiGate.

What would be the impact of this configuration on FortiGate?

A
FortiGate will enable strict RPF on ail its interfaces and port1 will be enable for asymmetric routing.
B
FortiGate will enable strict RPF on all its interfaces and port1 will be exempted from RPF checks.
C
Port1 will be enabled with flexible RPF, and all other interfaces will be enabled for strict RPF
D
The global configuration will take precedence and FortiGate will enable strict RPF on all interfaces.

Reveal answer details Close answer details

Correct answerB

Explanation

The global setting enables strict source checking (RPF) on all interfaces by default. The per-interface setting disables the source check on port1, exempting it from strict RPF enforcement.

Question 4

Single choice

Refer to the exhibit.

What can you conclude from the log shown in the exhibit?

A
The IPS scan is paused by the IPS diagnostic command with bypass mode option 5.
B
The IPS socket buffer is full and IPS engine needs more memory to create new sessions.
C
The IPS session scan is paused and reevaluating the packet because of a dirty flag.
D
The IPS socket buffer is full and IPS engine cannot decode a packet.

Reveal answer details Close answer details

Correct answerB

Explanation

The log message IPS session scan paused, enter fail open mode indicates that the IPS socket buffer is full, meaning the IPS engine does not have enough memory to process new sessions. As a result, FortiGate switches to fail-open mode, allowing traffic to pass (or temporarily dropping it) without full IPS scanning.

Question 5

Single choice

Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device.

The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24.

The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.11.50?

A
100.65.0.101
B
100.65.0.200
C
100.65.0.102
D
10.0.11.254

Reveal answer details Close answer details

Correct answerC

Explanation

Traffic from the workstation 10.0.11.50 going to the internet matches the Internet(1) policy (LAN WAN) which has NAT enabled and is configured to use the IP Pool. The IP pool specifies the external address
100.65.0.102.

FortiGate will perform source NAT (SNAT) on the outbound traffic, translating the source IP of the workstation to 100.65.0.102.

Question 6

Multiple choice

Refer to the exhibit, which shows a routing table.

An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.

What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

A
The new static route must have the distance set to 9.
B
The existing static route through port3 must have the distance set to 11.
C
The new static route must have the priority set to 3.
D
The new static route must have the metric set to 1.

Reveal answer details Close answer details

Correct answersA, B

Question 7

Single choice

An administrator manages a FortiGate model that supports NTurbo.

How does NTurbo acceleration enhance antivirus performance?

A
For proxy-based inspection, NTurbo offloads traffic to the content processor.
B
For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
C
For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.
D
For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.

Reveal answer details Close answer details

Correct answerB

Explanation

With flow-based inspection, NTurbo improves antivirus performance by establishing a dedicated fast data path that redirects traffic between the IPS engine and the FortiGate ingress/egress interfaces. This reduces CPU overhead, allowing antivirus scanning to happen at higher throughput without requiring full proxy-based buffering.

Question 8

Multiple choice

Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

A
Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
B
Pre-shared key and certificate signature as authentication methods
C
No certificate is required on the remote peer when you set the certificate signature as the authentication method
D
Extended authentication (XAuth) to request the remote peer to provide a username and password

Reveal answer details Close answer details

Correct answersB, D

Question 9

Single choice

Refer to the exhibits.

A web filter profile configuration and firewall policy configuration are shown. You are trying to access www.facebook.com, but you are redirected to a FortiGuard web filtering block page.
Based on the exhibits, what is the possible cause of the issue?

A
The web filter profile feature set is configured incorrectly.
B
The web rating override configuration is incorrect.
C
The firewall policy inspection mode is incorrect.
D
For www.facebook.com, the URL filter action is incorrect.

Reveal answer details Close answer details

Correct answerB

Explanation

The web filter profile shows a URL filter override for www.facebook.com with action Monitor, which should allow access. However, the block page shows FortiGuard categorizing www.facebook.com as Malicious Websites and blocking it. This indicates that the web rating override configuration is incorrect (the override is not applied properly), so FortiGuard's default category action takes precedence and blocks the site.

Question 10

Single choice

A user authenticated via FSSO is unable to access the internet. The administrator verifies that the user successfully logged into the domain.

What should the administrator check first?

A
Whether the Collector Agent is reachable on TCP 8000
B
Whether the user's IP address appears in the FSSO active user list
C
Whether LDAP server connectivity is working
D
Whether NTLM authentication is enabled

Reveal answer details Close answer details

Correct answerB

Explanation

Even if AD login is successful, FortiGate relies on the FSSO active user list to map username and IP. If the user does not appear in the list, identity-based policies will not match.

Question 11

Single choice

An administrator enabled certificate inspection on a firewall policy. Users report that access to several SaaS applications fails, even though the policy is configured to allow the traffic.

What is the most likely cause?

A
The FortiGate CA certificate is not imported into client browsers
B
The SaaS application enforces HSTS and blocks FortiGate's temporary certificate
C
The SaaS application does not support TLS session reuse
D
The SaaS domain is exempted from deep inspection but not from certificate inspection

Reveal answer details Close answer details

Correct answerB

Explanation

Some SaaS applications enforce strict HSTS (HTTP Strict Transport Security).
With certificate inspection, FortiGate cannot present original certificates, causing HSTS-protected sites to reject connections, even though SSL decryption is not performed.

Question 12

Single choice

You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied.

What should the administrator check first?

A
Whether the user is assigned to the correct AD group.
B
The FortiGate firewall policy settings for SSL decryption.
C
The FortiGate FSSO active users list for user's IP address.
D
The windows event viewer for failed login attempts.

Reveal answer details Close answer details

Correct answerC

Explanation

Checking the active users list verifies if FortiGate correctly associates the user with their IP address, ensuring proper policy enforcement for internet access.

Question 13

Multiple choice

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

A
The subject alternative name (SAN) field in the server certificate.
B
The server name indication (SNI) extension in the client hello message.
C
The serial number in the server certificate.
D
The subject field in the server certificate.
E
The host field in the HTTP header.

Reveal answer details Close answer details

Correct answersA, B, D

Question 14

Single choice

Which statement is a characteristic of automation stitches?

A
They can have one or more triggers.
B
They can be created only on downstream devices in the fabric.
C
They can run multiple actions at the same time.
D
They can be run only on devices in the Security Fabric.

Reveal answer details Close answer details

Correct answerC

Question 15

Single choice

Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.

An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.

The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.

Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?

A
Disable match-vip in the Allow_access policy
B
Configure a One-to-One IP Pool object in a new policy.
C
Set the Destination address as Webserver in the Deny policy.
D
Set the Destination address as Deny_IP in the Allow_access policy.

Reveal answer details Close answer details

Correct answerC

Explanation

To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.

Question 16

Single choice

Refer to the exhibits.

An administrator creates a new address object on the root FortiGate (HQ-NGFW-1) in the Security Fabric.
After synchronization, this object is not available on the downstream FortiGate (HQ-ISFW).

What must the administrator do to synchronize the address object?

A
Change the csf setting on HQ-ISFW (downstream) to set configuration-sync local.
B
Change the csf setting on HQ-ISFW (downstream) to set saml-configuration-sync default.
C
Change the csf setting on HQ-NGFW-1 (root) to set fabric-object-unification default.
D
Change the csf setting on both devices to set downstream-access enable.

Reveal answer details Close answer details

Correct answerC

Explanation

On HQ-NGFW-1 (the root FortiGate), the setting set fabric-object-unification local prevents address objects created on the root from synchronizing downstream. To propagate objects across the Security Fabric, this must be set to default. Changing the root's csf configuration to set fabric-object-unification default ensures that new address objects are synchronized to HQ-ISFW and other downstream devices.

Question 17

Multiple choice

Which three methods are used by the collector agent for AD polling? (Choose three.)

A
WinSecLog
B
NetAPI
C
FortiGate polling
D
FSSO REST API
E
WMI

Reveal answer details Close answer details

Correct answersA, B, E

Question 18

Multiple choice

You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.

In which two ways can you effectively resolve the problem? (Choose two.)

A
You can turn off IKE fragmentation to fix large certificate negotiation problems.
B
You should use IPsec to solve issues with fragment drops and large certificate exchanges.
C
You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or
4500).
D
You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

Reveal answer details Close answer details

Correct answersC, D

Question 19

Single choice

You have created a web filter profile named restrict_media-profile with a daily category usage quota.

When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available
web profile drop down.

What could be the reason?

A
The firewall policy is in no-inspection mode instead of deep-inspection.
B
The inspection mode in the firewall policy is not matching with web filter profile feature set.
C
The web filter profile is already referenced in another firewall policy.
D
The naming convention used in the web filter profile is restricting it in the firewall policy.

Reveal answer details Close answer details

Correct answerB

Explanation

Web filter profiles with category usage quotas require the firewall policy to be in proxy-based (deep) inspection mode; if the inspection mode does not match this requirement, the profile will not appear in the
drop-down list.

Question 20

Multiple choice

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec

VPN tunnels and static routes.

All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.

Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

A
In the phase1-interface, enable npu-offload to detect a dead tunnel.
B
Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
C
Enable Dead Peer Detection.
D
Use the VPN wizard to create an IPsec template for a redundant IPsec VPN tunnel.

Reveal answer details Close answer details

Correct answersB, C

Explanation

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel This ensures that the primary tunnel is always preferred, and the secondary is only used when the primary route is unavailable.

Enable Dead Peer Detection DPD allows FortiGate to quickly detect when the primary tunnel is down, enabling faster failover to the backup tunnel.

Question 21

Multiple choice

Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

A
The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
B
The client FortiGate requires a manually added route to remote subnets.
C
The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
D
The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.

Reveal answer details Close answer details

Correct answersA, D